Little Boy's SecHub

SecHub Landing Page and Overview Dashboard
SecHub System Architecture
SecHub System Design

Inspiration

Most resources for learning web security stop at theory. Articles, videos, checklists that tell you what a vulnerability is but never let you actually exploit one. We wanted something different: a platform where a learner reads a focused lesson, launches a real vulnerable target, exploits it themselves, and gets scored on the result, all in one continuous loop instead of separate disconnected steps.

What it does

SecHub Academy is a full stack web pentest learning platform. It pairs a bilingual (English and Vietnamese) security knowledge base covering vulnerability classes like SQL Injection, XSS, CSRF, SSRF, IDOR, authentication failures, cryptographic failures, and API security, with hands on labs that run as isolated, disposable Docker containers.

The learning loop is simple: read a lesson, launch or generate a matching lab, exploit the vulnerable target in a sandboxed runtime, submit the flag, get scored, then review weak topics through practice cards and follow up labs. On top of that we built growth profiles, activity history, a leaderboard, daily labs, weekly challenges, an author workspace for publishing new content, and realtime notifications over Server Sent Events.

How we built it

The frontend is Next.js 16 with React 19 and TypeScript, deployed on Vercel. The backend is a Spring Boot 3 application on Java 17, running on our own VPS behind Nginx, backed by PostgreSQL 16 through Spring Data JPA. Authentication uses JWT with BCrypt password hashing and role based access control.

The interesting part is the AI layer. We use GPT-5.6 in two separate roles. Codex with GPT-5.6 Sol was our engineering partner throughout development: it worked across the whole repository (frontend, backend, database entities, Docker runtime, CI workflows) to implement features, debug production issues like stale URLs and CORS failures, write and review tests, and even produce our system design documentation. Every diff it produced still went through our own review and the existing test suite before shipping.

Separately, GPT-5.6 Terra runs inside the deployed application itself through the OpenAI Responses API. When a learner requests a lab, Terra generates a structured lab specification: a lesson aware scenario, progressive hints, an estimated completion time, and a point value. The backend validates that output, maps it to a known challenge profile, and generates the actual manifest, app code, and Dockerfile for a fresh container. If the AI response is missing or invalid, SecHub falls back to local deterministic templates so the learning workflow never breaks.

Lab containers run with a read only filesystem, dropped Linux capabilities, no-new-privileges, and CPU, memory, and PID limits, since these are intentionally vulnerable applications that need to stay contained. We tested with JUnit, Mockito, and Vitest, load tested with k6, and shipped through GitHub Actions into a systemd managed production deployment.

Challenges we ran into

Letting users genuinely exploit a vulnerability, not click through a guided demo, meant every lab needed real isolation: its own container, its own flag, its own expiring runtime token, with no way for one learner's attempt to touch another's session or the platform itself. Getting the AI generated lab specs to reliably map onto safe, working Docker artifacts, and building a deterministic fallback for when the AI call fails, took real iteration. Coordinating a Next.js frontend against a Spring Boot backend under a tight hackathon timeline, while still deploying to a real production VPS with TLS and CI/CD, also pushed us to lean hard on Codex for repository wide debugging.

Accomplishments that we're proud of

We shipped a fully deployed product, not a local demo: live frontend on Vercel, a Spring Boot API on our own VPS behind Nginx with TLS, PostgreSQL in production, and real Docker backed labs with security hardening. The platform covers multiple vulnerability classes across structured learning paths, supports two languages, and combines AI generated content with deterministic learner analytics so scoring and recommendations stay grounded in real activity rather than model guesses.

What we learned

We learned how to split responsibility between an AI engineering partner and a runtime AI feature inside the same product, and why that split matters: Codex helped us move fast across an unfamiliar amount of surface area, while GPT-5.6 Terra needed strict validation and a fallback path before we could trust it in front of real learners. We also got much more comfortable with container security hardening, since running intentionally vulnerable code safely is a very different problem from running normal application code.

What's next for SecHub

More vulnerability categories and lab variants, expanding the 2D game mode, and deepening the AI Mentor so post lab feedback becomes model generated rather than templated, while keeping the same validation and fallback safety net we already rely on.